refactor: consolidate all roles into ansible/roles/ and update ansible.cfg

- Move all roles from playbooks/roles/ to roles/
- Update roles_path in ansible.cfg
- Add cast user to common role
- Create standalone podman role
- Add semaphore role with Podman + Quadlet support

ansible/roles/haproxy/templates/cloudflare-credentials.ini.j2

@@ -0,0 +1,12 @@
+# {{ ansible_managed }}
+# Cloudflare API credentials for Certbot DNS-01 challenge
+# This file contains sensitive information and should be protected
+
+# Cloudflare API Token (RECOMMENDED)
+# Create at: https://dash.cloudflare.com/profile/api-tokens
+# Required permissions: Zone:DNS:Edit for specific zone
+dns_cloudflare_api_token = {{ haproxy_certbot_cloudflare_api_token }}
+
+# Alternative: Global API Key (NOT RECOMMENDED - too permissive)
+# dns_cloudflare_email = your-email@example.com
+# dns_cloudflare_api_key = your-global-api-key